On Fri, Jan 24, 2014, Jeffrey Walton wrote: > I'm having a heck of a time getting the SAN into a server's CSR. > > I believe the relevant sections are: > > [ req ] > req_extensions = server_req_extensions > > [ server_req_extensions ] > > subjectKeyIdentifier = hash > basicConstraints = CA:FALSE > keyUsage = nonRepudiation, digitalSignature, keyEncipherment > subjectAltName = @alternate_names > nsComment = "OpenSSL Generated Certificate" > > [ alternate_names ] > > DNS.1 = example.com > DNS.2 = www.example.com > DNS.3 = mail.example.com > DNS.4 = ftp.example.com > > I then generate the CSR with `openssl req -config openssl-server.cnf > -newkey rsa:2048 -sha256 -nodes -out serverreq.csr -outform PEM` > > However, when I dump the CSR with `openssl req -text -noout -verify > -in servercert.csr`, I see the SANs are not present: > > $ openssl req -text -noout -verify -in servercert.csr > verify OK > Certificate Request: > Data: > Version: 0 (0x0) > Subject: C=XX, ST=XX, L=XX, CN=Test > Server/[email protected] > Subject Public Key Info: > Public Key Algorithm: rsaEncryption > Public-Key: (2048 bit) > Modulus: > 00:d5:6f:24:e9:70:5d:40:47:73:e0:b8:f3:4d:48: > ... > b9:19:d1:6b:92:2f:ad:1e:bd:ca:12:86:08:3d:41: > f3:03 > Exponent: 65537 (0x10001) > Attributes: > a0:00 > Signature Algorithm: sha256WithRSAEncryption > 74:98:1d:10:23:2b:73:29:f3:dd:3d:76:c2:69:08:5a:5e:d2: > ... > 39:06:e0:eb > > I tried adding `subjectAltName=dns:copy`, but that resulted in an > error (so I know the section is being read): > > Error Loading extension section server_extensions > 140490047387304:error:22075075:X509 V3 > routines:v2i_GENERAL_NAME_ex:unsupported option:v3_alt.c:557:name=dns > 140490047387304:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error > in extension:v3_conf.c:93:name=subjectAltName, value=dns:copy > > Any ideas what I'm doing wrong?
Hmm... it isn't adding any extensions at all. What version of OpenSSL are you using? Could you post the complete openssl.cnf? Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
